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WHAT IS CLAIMED IS 




1. A method for visualizing a network having a plurality of nodes, comprising: 
collecting information from at le^st one of the nodes, the information describing network 

operation over a period of time; 

reconstructing the network operation for^he time period from the collected information; 

and 

presenting the reconstructed network operation tcKan operator. 

2. The method of claim 1 , wherein the collecting includes: 
obtaining at least one of node status change information, information regarding 

messages received and transmitted in the network, and link status change information. 



3. The method of claim 1, wherein the collecting includes: 
obtaining forwarding tables from the nodes. 



4, The method of claim 3, wherein the reconstructing includes: 
creating forwarding tables from the collected information. 



5. The method of claim 4, further comprising: 

comparing the forwarding tables obtained from the nodes to the created forwarding 
tables; and 

measuring routing protocol convergence time based on the comparison. 
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6. The method of claim 1, wherein the reconstructing includes: 
combining information from at least two of the nodes, 
sorting the combined information by time, and 
reconstructing the network operation using the sorted information. 



7. The method of claim 1 , wherein the presenting includes: 

displaying the reconstructed network operation to the operator as an interactive 
network topology diagram. — 



8. The method of claim 7, wherein the displaying includes: 

providing detailed information regarding the network operation in response to an 
instruction from the operator. 



9. The method of claim 8, wherein the providing includes: 

displaying detailed information regarding one of a node, a link, and a message in 
the network. 



A 



10. The method of claim 1, wherein the presenting includes: 
displaying the reconducted network operation to the operator, and 
permitting the operator to manipulate the display. 

11. The method of claim 1, wherein the presenting includes: 

replaying the reconstructed network operatioliover the time period, and 
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pennitting the operator to manipulate the replay operation. 

12. The method of claim 11, wherein the permitting includes: 

allowing the operator to at least one of fast forward and rewind the replay 
operation. 



13. A system for visualizing aiietwork having a plurality of nodes, comprising: 
means for collecting information froiV at least one of the nodes, the information 
describing network operation over a period of time; 

means for reconstructing the network operation for the time period from the collected 
5 information; and 

means for presenting the reconstructed network opefcition to an operator. 



J 



14. A system for visualizing a network having a plurality of nodes, comprising: 

a memory that stores instructions; and 

a processor configured to execute the instructions in the memory th collect information 
from at least one of the nodes, the information describing network operation over a period of 
time, reconstruct the network operation for the time period from the collected information, and 
present the reconstructed network operation to an'OpefatOr. 



15. The system of claim 14, wherein when collecting, the processor is configured to 
obtain at least one of node status change information, information regarding messages received 
and transmitted in the network, and link status change information. 
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16. The system of claim 14, wherein when collecting, the processor is configured to 
obtain forwarding tables from the nodes. 

17. The system of claim 16, wherein when reconstructing, the processor is configured 
to create forwarding tables from the collected information. 

18. The system of claim 17, wherein the processor is further configured to compare 
the forwarding tables obtained from the nodes to the created forwarding tables, and measure 
routing protocol convergence time based on the comparison. 

19. The system of claim 14, wherein when reconstructing, the processor is configured 
to combine information from at least two of the nodes, sort the combined information by time, 
and reconstruct the network operation using the sorted information. 



20. The system of claim 14, wherein when presenting, the processor is configured to 
CX \ display tlie reconstructed network operation to the operator as an interactive network topology 
)r 1 diagram. " 



21. The system of claim 20, wherein when displaying the processor is configured to 
provide detailed information regarding the network operation in response to an instruction from 
t h e operator: ; ' — ■ 
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22. The system of claim 21, wherein when providing, the processor is configured to 
display detailed information regarding one of a node, a link, and a message in the network. 

23. Tne system of claim 14, wherein when presenting, the processor is configured to 
display the reconstructed network operation to the operator, and permit the operator to 
manipulate the display. 

24. The system of claim 14, wherein when presenting, the processor is configured to 
replay the reconstructed network operation over the time period, and permit the operator to 
manipulate the replay operation. 

25. The system of claim 24, wherem when permitting, the processor is configured to 
allow the operator to at least one of fast forward a&d rewind the replay operation. 



26. A computer-readable medium that stores instructions for causing at least one 
processor to perform a method for visualizing a network having a plurality of nodes, the method 
comprising: 

collecting information from at least one of the nodes, the information describing network 
operation over a period of time; 

reconstructing the network operation for the time period from the collected information; 

and 



presenting the iccu nstrucied network operation to an operator 
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27. A computer-readable memory device of a node in a network containing a network 

operations data structure, comprising: 

a first area that stores information regarding node status changes; 

a second area that stores information regarding messages received and transmitted by the 
node; and 

a third area that stores information regarding link status changes in the network. 



28. The computer-readable memory device of claim 27, wherein the node status 
change information includes information regarding state changes of the node and time stamps 
indicating times corresponding to the state changes. 

29. The computer-readable memory device of claim 27, wherein the message 
information includes information regarding messages transmitted or received by the node and 
time stamps indicating times corresponding to the transmission or reception of the messages by 
the node. 



30. The computer-readable memory device of claim 27, wherein the link status 
change information includes information regarding attribute changes of a link in the network and 
time stamps indicating times corresponding to the attribute changes. 



3 1 . The computer-readable memory device of claim 27, further comprising: 
a fourth area that stores a forwarding table for the node. 
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32. An interactive graphical user interface for visualizing a network having a plurality 
of nodes, comprising: 

a network topology diagram configured to display at least some of the nodes, links 
connecting the nodes, and messages transmitted through the network; and 

replay controls that permit an operator to control a replay sequence of the network as the 
network operates over a period of time. 

33. The graphical user interface of claim 32, wherein the replay controls include 
controls for performing at least one of a fast forward, a rewind, a step forward, and a step 
backward of the replay sequence. 

34. A method for visualizing a network having a plurality of nodes, comprising: 
recording network events by one or more of the nodes over a period of time; 
collecting the recorded events from the nodes; 

recreating operation of the network over the time period from the recorded events; and 
displaying the recreated network operation, 

35. The method of claim 34, wherein the recording includes: 
generating a time stamp for each of the recorded events. 

36. The method of claim 35, wherein the recreating includes: 
combining the recorded events from the nodes, and 

sorting the recorded events based on the generated time stamps. 
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